In-service software upgrade with active service monitoring

1. A computer-executed method for performing an in-service software upgrade on a network device, the method comprising:

in response to a software-upgrade command, generating an upgrade database based on a state database storing both a data-plane state and a control-plane state associated with the network device, wherein the network device is managed by a management unit comprising a data-plane-management sub-unit for configuring hardware devices according to the data-plane state and a control-plane sub-unit for monitoring the control-plane state, and wherein the upgrade database stores at least a copy of the data-plane state prior to the upgrade;

upgrading the management unit by separately upgrading the data-plane-management sub-unit and the control-plane sub-unit, without interrupting services provided by the network device, wherein upgrading the data-plane-management sub-unit comprises:

terminating the data-plane-management sub-unit to allow the hardware devices to operate in an autonomous mode;

restarting a newer version of the data-plane-management sub-unit; and

reattaching the newer version of the data-plane-management sub-unit to the hardware devices based on the copy of the data-plane state prior to the upgrade stored in the upgrade database;

monitoring the control-plane state in the state database and the data-plane state in the upgrade database to detect an event associated with the network device during the upgrading of the management unit; and

in response to determining, based on the detected event and a set of pre-defined criteria, that a triggering condition is met, performing an action to prevent a network outage or error.

2. The method of claim 1 , wherein generating the upgrade database comprises creating a clone of the state database or copying the data-plane state into the upgrade database.

3. The method of claim 1 , wherein the management unit executes on a first processor, and wherein restarting the newer version of the data-plane-management sub-unit comprises executing the newer version of the data-plane-management sub-unit on a second standby processor.

4. The method of claim 3 , wherein upgrading the control-plane sub-unit comprises:

terminating the control-plane sub-unit; and

restarting a newer version of the control-plane sub-unit on the second standby processor.

5. The method of claim 1 , wherein the set of predefined criteria comprises one or more of:

the detected event is associated with a critical service;

the detected event is associated with a critical port;

the detected event is associated with a critical interface;

the detected event is associated with a critical overlay;

the detected event is a pre-determined AAA (Authentication, Authorization, and Accounting) event;

the detected event is associated with a predetermined network protocol; and

the detected event is an internal failure of the management unit.

6. The method of claim 1 , wherein the triggering condition comprises one or more of:

the detected event may cause the in-service software upgrade to fail;

the detected event may cause instability in the network;

the detected event may cause an outage or error in the network; and

the detected event may interrupt a critical service.

7. The method of claim 1 , wherein the action comprises one or more of:

pausing the upgrading of the management unit;

rolling back the upgrading of the management unit to a previous state;

aborting the upgrading of the management unit; and

rebooting the network device.

8. The method of claim 1 , wherein upgrading the management unit further comprises converging the data-plane state in the upgrade database and the control-plane state in the state database.

9. A computer system, comprising:

a processor; and

a storage device coupled to the processor and storing instructions that when executed by the processor cause the processor to perform a method for facilitating an in-service software upgrade on a network device, the method comprising:

in response to a software-upgrade command, generating an upgrade database based on a state database storing both a data-plane state and a control-plane state associated with the network device, wherein the network device is managed by a management unit comprising a data-plane-management sub-unit for configuring hardware devices according to the data-plane state and a control-plane sub-unit for monitoring the control-plane state, and wherein the upgrade database stores at least a copy of the data-plane state prior to the upgrade;

upgrading the management unit by separately upgrading the data-plane-management sub-unit and the control-plane sub-unit, without interrupting services provided by the network device, wherein upgrading the data-plane-management sub-unit comprises:

terminating the data-plane-management sub-unit to allow the hardware devices to operate in an autonomous mode;

restarting a newer version of the data-plane-management sub-unit; and

reattaching the newer version of the data-plane-management sub-unit to the hardware devices based on the copy of the data-plane state prior to the upgrade stored in the upgrade database;

monitoring the control-plane state in the state database and the data-plane state in the upgrade database to detect an event associated with the network device during the upgrading of the management unit; and

in response to determining, based on the detected event and a set of pre-defined criteria, that a triggering condition is met, performing an action to prevent a network outage or error.

10. The computer system of claim 9 , wherein generating the upgrade database comprises creating a clone of the state database or copying the data-plane state into the upgrade database.

11. The computer system of claim 9 , wherein the management unit executes on a first processor, and wherein executing restarting the newer version of the data-plane-management sub-unit comprises executing the newer version of the data-plane-management sub-unit on a second standby processor.

12. The computer system of claim 11 , wherein upgrading the control-plane sub-unit comprises:

terminating the control-plane sub-unit; and

restarting a newer version of the control-plane sub-unit on the second standby processor.

13. The computer system of claim 9 , wherein the set of predefined criteria comprises one or more of:

the detected event is associated with a critical service;

the detected event is associated with a critical port;

the detected event is associated with a critical interface;

the detected event is associated with a critical overlay;

the detected event is a pre-determined AAA (Authentication, Authorization, and Accounting) event;

the detected event is associated with a predetermined network protocol; and

the detected event is an internal failure of the management unit.

14. The computer system of claim 9 , wherein the triggering condition comprises one or more of:

the detected event may cause the in-service software upgrade to fail;

the detected event may cause instability in the network;

the detected event may cause an outage or error in the network; and

the detected event may interrupt a critical service.

15. The computer system of claim 9 , wherein the action comprises one or more of:

pausing the upgrading of the management unit;

rolling back the upgrading of the management unit to a previous state;

aborting the upgrading of the management unit; and

rebooting the network device.

16. The computer system of claim 9 , wherein upgrading the management unit further comprises converging the data-plane state in the upgrade database and the control-plane state in the state database.

17. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for facilitating an in-service software upgrade on a network device, the method comprising:

in response to a software-upgrade command, generating an upgrade database based on a state database storing both a data-plane state and a control-plane state associated with the network device, wherein the network device is managed by a management unit comprising a data-plane-management sub-unit for configuring hardware devices according to the data-plane state and a control-plane sub-unit for monitoring the control-plane state, and wherein the upgrade database stores at least a copy of the data-plane state prior to the upgrade;

upgrading the management unit by separately upgrading the data-plane-management sub-unit and the control-plane sub-unit, without interrupting services provided by the network device, wherein upgrading the data-plane-management sub-unit comprises:

terminating the data-plane-management sub-unit to allow the hardware devices to operate in an autonomous mode;

restarting a newer version of the data-plane-management sub-unit; and

reattaching the newer version of the data-plane-management sub-unit to the hardware devices based on the copy of the data-plane state prior to the upgrade stored in the upgrade database;

monitoring the control-plane state in the state database and the data-plane state in the upgrade database to detect an event associated with the network device during the upgrading of the management unit; and

in response to determining, based on the detected event and a set of pre-defined criteria, that a triggering condition is met, performing an action to prevent a network outage or error.

18. The non-transitory computer-readable storage medium of claim 17 , wherein the set of predefined criteria comprises:

the detected event is associated with a critical service;

the detected event is associated with a critical port;

the detected event is associated with a critical interface;

the detected event is associated with a critical overlay;

the detected event is a pre-determined AAA (Authentication, Authorization, and Accounting) event;

the detected event is associated with a predetermined network protocol; and

the detected event is an internal failure of the management unit.